fix(sbom): make sc sbom generate fail loudly on syft errors#292
Merged
Conversation
The standalone CLI built a SecurityConfig with SBOM.Required=false, which told the executor to fail-open: on syft errors it printed "Warning: SBOM generation failed, continuing" and returned (nil, nil). The CLI wrapper then turned that nil-nil into "Error: no SBOM generated" and exited 1 — fail-open semantics with a fail-closed exit code. For a user-invoked `sc sbom generate`, the right behavior is fail-loud: surface the real syft error (signal: killed for OOM, registry timeouts, etc.) so the caller knows why. Setting Required=true makes the executor return the underlying error directly, which the wrapper already maps to "failed to generate SBOM: <reason>". Surfaced by a PAY-SPACE pay_space_wallet production deploy where syft was OOM-killed on a large image; Pulumi saw "no SBOM generated" exit 1 and aborted the stack update. Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
Semgrep Scan ResultsRepository:
Scanned at 2026-05-26 17:15 UTC |
Security Scan ResultsRepository:
Scanned at 2026-05-26 17:15 UTC |
smecsia
approved these changes
May 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sc sbom generatebuilt aSecurityConfigwithSBOM.Required=false, which tells the executor to fail-open: on syft errors it printsWarning: SBOM generation failed, continuingand returns(nil, nil). The CLI wrapper then converted thatnil,nilintoError: no SBOM generatedand exited 1 — fail-open semantics with a fail-closed exit code, and the underlying syft error (e.g.signal: killedfor OOM) never reached the user.This PR sets
Required: truefor the standalone CLI so the executor returns the real error directly, which the wrapper already maps tofailed to generate SBOM: <reason>. The redundantif generatedSBOM == nilcheck after a non-nil-err path is also removed.The Pulumi deploy path (
pkg/clouds/pulumi/docker/build_and_push.go) is unchanged — it still honors whatever the user set in their stack'ssbom.required.Background
Surfaced by a PAY-SPACE
pay_space_walletproduction deploy where syft was OOM-killed on a large image. Pulumi saw the SBOM step exit 1 with the misleadingno SBOM generatedmessage and aborted the stack update. With this change, the user will seefailed to generate SBOM: syft command failed: signal: killedinstead and can act on it (bump runner memory, opt into fail-open in their stack config, etc).Test plan
go build ./pkg/cmd/cmd_sbom/... ./pkg/security/...cleansc sbom generateagainst a tiny image — still succeedsno SBOM generatedScope
Touches only the standalone
sc sbom generateCLI. No doc updates needed:docs/docs/reference/security-cli-commands.mdonly lists flags; fail-open mentions indocs/product-manager/container-security/acceptance-criteria.md(andapi-contracts.md) are about the executor's deploy-path default, which is unchanged.